For decades, Linux has been synonymous with technological freedom, user control, and cybersecurity. The open-source nature of Linux has cemented the belief that it is an inherently more reliable platform than its proprietary counterparts, especially regarding privacy. However, this perception of Linux has been challenged by a recent finding that significantly compromises one of its most common default applications: Evolution, the email client widely used in GNOME environments.
What seemed to be a secure and robust option has proven to contain a critical vulnerability that allows third parties to obtain sensitive user information just by opening an email. The discovery on Linux calls into question the blind trust that many users place in their operating system and its default applications.
Specifically, it reveals how the integration of external Linux components —in this case, the WebKitGTK rendering engine— can undermine security measures apparently enabled by the user, generating a false sense of protection. This incident on Linux not only affects those who have consciously chosen to use Evolution, but millions who simply found it preinstalled and assumed their privacy values were intact.
What is Evolution and why is it so widely used?
Evolution is not simply a Linux email client. It is a complete personal productivity solution that combines email, calendar, task management, and contacts, all under the same interface designed to integrate seamlessly with the Linux GNOME ecosystem. Originally developed by Ximian in 2000 and later acquired by Novell, the project came under the wing of the GNOME project, establishing itself as the default option in GTK environments.
What has facilitated its massive adoption is not necessarily its superiority over other clients, but its condition as preinstalled software on popular distributions like Fedora, Ubuntu (GNOME editions), POP!_OS, Zorin OS, or even Elementary OS in specific versions. This automatic distribution has guaranteed it widespread presence, although in many cases invisible on Linux.
For most Linux users, Evolution is simply there, running in the background or enabled by default, without its security settings being reviewed or critically evaluating its suitability compared to other ecosystem options. Its ability to connect with services like Microsoft Exchange, Google Workspace, and IMAP or POP3 servers makes it a versatile tool. However, that versatility also makes it more complex, more dependent on external libraries, and therefore more prone to failures if not managed with due rigor. Precisely here lies the current problem Linux faces: Evolution does not fail by itself, but because of the way it delegates responsibilities to components outside its direct control.
Discovery of the vulnerability: A silent failure emerges
The alert about this vulnerability on Linux did not come from a large corporation or a government team, but from the meticulous work of Mike Cardwell, a UK-based systems administrator with a recognized track record in digital security. In his analysis of Evolution's behavior, Cardwell identified an unexpected pattern: the client was making DNS queries to domains mentioned in HTML emails, even when the option to block remote content was disabled.
This implied that, without the user's consent or interface visibility on Linux, sensitive data was being leaked every time an apparently harmless message was opened. The mechanism behind this information leak is relatively simple but highly effective. By embedding an image in an HTML email, for example through a tag like:
<img src="»tracking.ejemplo.com/imagen.png»">
The attacker causes the email client to resolve the resource domain, even though it does not download it directly.
Although it may seem that nothing happens, the mere DNS resolution already generates a request that is logged on the attacker's servers, revealing the user's IP address, the time the message was opened, and in many cases their approximate location. All this happens without the image being displayed, without notifying the user on Linux, and without having authorized the loading of remote content. It is literally a hidden backdoor in the normal usage flow.
The role of WebKitGTK: A silent ally... or a traitor
The technical origin of this vulnerability on Linux lies in the engine Evolution uses to render HTML emails: WebKitGTK, an adaptation of the WebKit engine for GTK environments. This Linux component, shared by several projects within the Linux ecosystem, acts as an embedded web browser and, in theory, should respect the security settings of the client that uses it. However, it does not.
WebKitGTK realiza consultas DNS como parte de su estrategia de prefetching y optimización de carga, incluso en condiciones donde debería abstenerse por razones de privacidad. En particular, ignora etiquetas como <link rel=»dns-prefetch»> y <link rel=»preconnect»>, y además no emite señales que permitan interceptar estas peticiones antes de que ocurran. Para los desarrolladores de Evolution de Linux, esto representa una trampa técnica: aunque quieran bloquear estas conexiones, WebKitGTK simplemente no les da la oportunidad de hacerlo.
Even more alarming is that recent versions of WebKitGTK (such as 2.48 and above) have removed the enable-dns-prefetching configuration option, effectively eliminating one of the few existing barriers against these leaks. What should be an obedient rendering engine on Linux thus becomes a blind spot that undermines the email client’s security architecture, without the user having any way to know or remedy it from the graphical interface.
Response from the Evolution and GNOME teams
When Cardwell reported the failure on Linux to the Evolution development team, the response was disappointing, though not unexpected. The existence of the behavior was acknowledged, but it was claimed that the responsibility lay exclusively with WebKitGTK. Consequently, the team closed the ticket without applying any local mitigation or visible warning in the Linux application.
One of the main developers justified this decision arguing that fixing the failure in Evolution on Linux would be a partial and fragile solution, since the real problem was in the rendering engine. However, Cardwell proposed practical solutions that could have been implemented immediately, such as displaying a visible warning to the user when opening an HTML email, or filtering specific tags before passing them to WebKitGTK. He also suggested including whitelists of trusted elements or, at least, initiating an active dialogue with the WebKitGTK maintainers.
GNOME’s response was even more controversial. A Linux developer publicly accused Cardwell of “defaming the project” for making the report public, which provoked outrage in the community and escalated the discussion. Instead of cooperating to find a solution, the parties involved locked themselves in defensive positions, leaving the end user in a prolonged vulnerability situation.
Real impact: Privacy at risk
1. Read confirmation without consent
The ability to detect whether an email has been opened, when, and from where represents a covert form of surveillance that violates personal and professional privacy now happening on Linux. In sensitive contexts, such as journalism, human rights defense, or internal company communications, this information can be maliciously used to track, intimidate, or discriminate.
2. IP address and geolocation leakage
A user's IP is one of the key pieces to infer their geographic location, internet provider, and even if they are inside a corporate network. This kind of metadata, although seemingly innocuous, can be used for targeted attacks or to establish behavior profiles without consent, which Linux users should take into account.
3. Open door for phishing campaigns
Attackers can use this leaked information from Linux to confirm the existence of an active account and prepare more sophisticated attacks. Knowing an email was opened is a signal to send a second message, this time with more refined social engineering techniques.
4. Breakdown of default security
The principle of "security by default configuration" is completely invalidated in this Linux case. Many users believe they are protected simply because they have disabled remote content loading, but in reality, they remain exposed.
5. Massive and inadvertent impact
Since Evolution is the default client in numerous Linux distributions, it is estimated that tens or hundreds of thousands of users are currently exposed, unaware of the flaw and without effective means to mitigate it from the usual interface.
Timeline: Two Years of Silent Exposure on Linux
- August 2023: First signs of the problem identified in WebKitGTK.
- April 2024: More aggressive variants detected, such as the tags.
- July 2025: Mike Cardwell publishes his findings after not receiving an effective response from the developers.
This timeline highlights a serious situation: for almost two years, millions of Linux users have been exposed without notification, patch, or official defense mechanism.
Why hasn’t it been fixed yet?
The core of the problem on Linux lies in a layered architecture with cross dependencies. Evolution, by relying on WebKitGTK, inherits both its advantages and its limitations. Fixing the flaw directly in Evolution would imply completely redoing the HTML rendering system or applying unsustainable patches that would be reverted in future Linux updates.
Additionally, Linux’s free software philosophy, while powerful, sometimes generates bottlenecks in responsibility management. Each project believes certain decisions should be made “upstream,” which dilutes the urgency to implement immediate solutions. This fragmentation of priorities on Linux has caused that, despite knowing the problem for some time, none of the parties have decided to act decisively.
Solutions and alternatives
1. Switch email client
Switching email clients on Linux is probably the most direct and effective measure to mitigate the risk posed by the vulnerability discovered in Evolution. The choice of a new client should focus on solutions that have demonstrated a proactive stance in protecting privacy, as well as an architecture designed to resist tracking techniques and metadata leaks.
One of the best alternatives on Linux is Thunderbird, developed by Mozilla. This client has a solid track record, an active community, and an infrastructure that allows blocking all kinds of remote content by default from the graphical interface, including HTML images, scripts, and tracking resources.
Its HTML rendering engine on Linux does not make external connections without explicit authorization and allows managing advanced security settings without the need for external plugins. Additionally, it is highly extensible and allows integration of features like native OpenPGP encryption, traffic redirection through Tor, or additional privacy filters—all without compromising user control over the environment.
Another solid option on Linux is Tuta Mail, a more recent platform but designed specifically with privacy as a guiding principle. Unlike traditional clients that simply connect to external servers via IMAP or POP, Tuta Mail controls its own infrastructure and applies end-to-end encryption to all message elements, including metadata that in other systems usually remains exposed, such as the subject or sender’s address.
Its client, available for Linux, mobile, and web, does not allow HTML tracking nor executes external DNS resolutions without authorization. It has also been one of the first services to adopt quantum-resistant cryptography, positioning it as a visionary choice for those seeking long-term protection.
Finally, there is Proton Mail, a Switzerland-based solution with an architecture similar to Tuta Mail for Linux. Although its desktop client is still in development and its out-of-browser experience may be limited, its security model is robust, and its end-to-end encryption has been widely audited. The company’s location in a jurisdiction with strict privacy laws gives it an additional advantage. Any of these three alternatives represents a clear improvement over Evolution, not only due to their technical resilience against vulnerabilities like the one described here, but also because of their cultural focus on user privacy.
2. Force plain text mode in Evolution
An intermediate solution for those who do not want or cannot immediately switch email clients on Linux is to configure Evolution to show only the plain text version of messages. This option can be enabled from the client’s preferences panel and has the immediate effect of disabling HTML rendering, which includes images, embedded links, CSS styles, and any potentially dangerous tag that could cause connections to external servers.
By operating in plain text on Linux, Evolution completely eliminates the possibility that the WebKitGTK engine executes hidden DNS resolutions, since it simply does not interpret the content as HTML code nor tries to visually render it. In this way, any attempt at tracking based on images or remote resources—even those disguised as passive elements—is effectively blocked.
However, this measure is not without consequences. Many modern emails, especially those from commercial services, support platforms, banks, or social networks, are designed almost exclusively in HTML format. Viewing them in plain text loses the visual structure, interactive buttons, explanatory images, and in some cases, links appear disorganized or hard to interpret on Linux.
This can affect the user experience on Linux and make reading certain messages less smooth, especially when dealing with automated notifications or newsletters. Therefore, while forcing plain text mode represents a very effective solution technically, it also implies a sacrifice in usability and aesthetics, which should be especially considered by non-technical users or those who rely on rich-formatted communications.
3. Use of VPN
Using a Virtual Private Network (VPN) is a key tool for protecting online privacy and can be an important complement to mitigate the effects of the vulnerability discovered in Evolution on Linux. Although it does not directly prevent read confirmation nor block remote domain resolution, a VPN hides the user’s real IP address, masking their geographic location and internet provider.
This means that even if an attacker manages to record that an email was opened, they will not be able to know the true IP nor associate the event with a precise location. Instead of seeing the Linux user’s address, the malicious server will only see the VPN server’s IP, which can be located anywhere in the world. This level of anonymity on Linux is not perfect but considerably complicates individual tracking attempts or building geographic profiles based on email open histories.
Additionally, many modern VPNs offer extra features such as DNS leak protection, kill switches, and split tunneling mechanisms that allow the user to decide which traffic goes through the VPN and which connects directly. It is important to clarify, however, that VPN use does not prevent tracking via HTML or DNS queries, nor block the activation of remote images or tags—this must be resolved at the email client level.
The VPN simply reduces the user’s exposure by making it harder to identify their location and real IP address, adding an additional complementary layer of protection but not sufficient on its own. For stronger defense, this measure should be combined with blocking remote content, using plain text, or migrating to a more secure client.
What happened with Evolution on Linux is a serious warning for the Linux ecosystem: even the most respected tools can contain silent vulnerabilities when integrating components without sufficient cross-review. Privacy is not an inherent property of free software: it is the result of conscious technical decisions, maintained over time, and reinforced by a community that acts responsibly.
Therefore, if you value your privacy, it is not enough to use Linux. It is necessary to audit, question, and when necessary, change tools, configure additional defenses, and maintain a critical attitude toward the implicit promises of security. If you want to learn more about the best cybersecurity practices for your Linux systems, write to us at [email protected]. We offer personalized cybersecurity advice so your operations remain protected.
EN 
ES